lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-Id: <20230328045006.2482327-1-windhl@126.com> Date: Tue, 28 Mar 2023 12:50:06 +0800 From: Liang He <windhl@....com> To: davem@...emloft.net, edumazet@...gle.com, kuba@...nel.org, pabeni@...hat.com, windhl@....com, netdev@...r.kernel.org Subject: [PATCH] rionet: Fix refcounting bugs In rionet_start_xmit(), we should put the refcount_inc() before we add *skb* into the queue, otherwise it may cause the consumer to prematurely call refcount_dec(). Besides, before the next rionet_queue_tx_msg() when we meet the 'RIONET_MAC_MATCH', we should also call refcount_inc() before the skb is added into the queue. Fixes: 7c4a6106d645 ("rapidio/rionet: fix multicast packet transmit logic") Signed-off-by: Liang He <windhl@....com> --- drivers/net/rionet.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/drivers/net/rionet.c b/drivers/net/rionet.c index fbcb9d05da64..72ccbb1aaf11 100644 --- a/drivers/net/rionet.c +++ b/drivers/net/rionet.c @@ -195,17 +195,19 @@ static netdev_tx_t rionet_start_xmit(struct sk_buff *skb, for (i = 0; i < RIO_MAX_ROUTE_ENTRIES(rnet->mport->sys_size); i++) if (nets[rnet->mport->id].active[i]) { - rionet_queue_tx_msg(skb, ndev, - nets[rnet->mport->id].active[i]); if (count) refcount_inc(&skb->users); count++; + rionet_queue_tx_msg(skb, ndev, + nets[rnet->mport->id].active[i]); } } else if (RIONET_MAC_MATCH(eth->h_dest)) { destid = RIONET_GET_DESTID(eth->h_dest); - if (nets[rnet->mport->id].active[destid]) + if (nets[rnet->mport->id].active[destid]) { + refcount_inc(&skb->users); rionet_queue_tx_msg(skb, ndev, nets[rnet->mport->id].active[destid]); + } else { /* * If the target device was removed from the list of -- 2.25.1
Powered by blists - more mailing lists